moonbitlang / core / 7847

88%

push

github

fix(builtin): reject negative and overflowing ranges in checked FixedArray blits

FixedArray::blit_to never checked len >= 0, and blit_to and both
make_and_blit variants compared offset + len against the length, which
wraps for large offsets. Both slipped through to the unchecked copy:
len=-1 crashed native, src_offset=Int::max read out of bounds.

Compare by subtraction instead, as FixedArray::blit_from_bytes does, via
a shared range_fits helper. The helper gets a whitebox test so the
overflow case is pinned on native too, where panic tests are excluded.

Co-Authored-By: Claude <noreply@anthropic.com>

8 of 8 new or added lines in 2 files covered. (100.0%)

25101 of 28385 relevant lines covered (88.43%)

409218.32 hits per line